From 6c881dbf2954ce31e5751e60cd257f2ee50221f3 Mon Sep 17 00:00:00 2001 From: Dave Tonge Date: Wed, 28 Oct 2026 14:20:18 +0100 Subject: [PATCH 1/2] List FAPI 2.0 Implementation Advice in README The draft was not linked from the README. Links broken by the file removals in #860 are left for a separate change. Refs #871 --- README.md | 1 + 1 file changed, 1 insertion(+) diff --git a/README.md b/README.md index 3ff78dd..2e2d4ab 100644 --- a/README.md +++ b/README.md @@ -15,6 +15,7 @@ The latest drafts are built automatically from this repository and published at * FAPI 2.0 - This is a profile of OAuth 2.0 * [Security Profile](fapi-2_0-security-profile.md) * [Message Signing](fapi-2_0-message-signing.md) + * [Implementation Advice](FAPI_2_0_Implementation_Advice.md) [issues](https://github.com/openid/fapi/issues?q=is%3Aissue%20state%3Aopen%20label%3A%22component%3A%20Implementation%20%26%20Deployment%20Advice%22) * [Attacker Model](FAPI_2_0_Attacker_Model.md) * [Grant Management](FAPI_2_0_Grant_Management.md) * Other documents From b9c713b44814039ed04e7012c42c6654c381381f Mon Sep 17 00:00:00 2001 From: Dave Tonge Date: Wed, 28 Oct 2026 14:20:31 +0100 Subject: [PATCH 2/2] Add document history Lists the changes in this draft for WG review. Refs #871 --- FAPI_2_0_Implementation_Advice.md | 13 ++++++++++++- 1 file changed, 12 insertions(+), 1 deletion(-) diff --git a/FAPI_2_0_Implementation_Advice.md b/FAPI_2_0_Implementation_Advice.md index b292d87..c87f2ac 100644 --- a/FAPI_2_0_Implementation_Advice.md +++ b/FAPI_2_0_Implementation_Advice.md @@ -442,4 +442,15 @@ Copyright (c) 2026 The OpenID Foundation. The OpenID Foundation (OIDF) grants to any Contributor, developer, implementer, or other interested party a non-exclusive, royalty free, worldwide copyright license to reproduce, prepare derivative works from, distribute, perform and display, this Implementers Draft, Final Specification, or Final Specification Incorporating Errata Corrections solely for the purposes of (i) developing specifications, and (ii) implementing Implementers Drafts, Final Specifications, and Final Specification Incorporating Errata Corrections based on such documents, provided that attribution be made to the OIDF as the source of the material, but that such attribution does not indicate an endorsement by the OIDF. -The technology described in this specification was made available from contributions from various sources, including members of the OpenID Foundation and others. Although the OpenID Foundation has taken steps to help ensure that the technology is available for distribution, it takes no position regarding the validity or scope of any intellectual property or other rights that might be claimed to pertain to the implementation or use of the technology described in this specification or the extent to which any license under such rights might or might not be available; neither does it represent that it has made any independent effort to identify any such rights. The OpenID Foundation and the contributors to this specification make no (and hereby expressly disclaim any) warranties (express, implied, or otherwise), including implied warranties of merchantability, non-infringement, fitness for a particular purpose, or title, related to this specification, and the entire risk as to implementing this specification is assumed by the implementer. The OpenID Intellectual Property Rights policy requires contributors to offer a patent promise not to assert certain patent claims against other contributors and against implementers. The OpenID Foundation invites any interested party to bring to its attention any copyrights, patents, patent applications, or other proprietary rights that may cover technology that may be required to practice this specification. \ No newline at end of file +The technology described in this specification was made available from contributions from various sources, including members of the OpenID Foundation and others. Although the OpenID Foundation has taken steps to help ensure that the technology is available for distribution, it takes no position regarding the validity or scope of any intellectual property or other rights that might be claimed to pertain to the implementation or use of the technology described in this specification or the extent to which any license under such rights might or might not be available; neither does it represent that it has made any independent effort to identify any such rights. The OpenID Foundation and the contributors to this specification make no (and hereby expressly disclaim any) warranties (express, implied, or otherwise), including implied warranties of merchantability, non-infringement, fitness for a particular purpose, or title, related to this specification, and the entire risk as to implementing this specification is assumed by the implementer. The OpenID Intellectual Property Rights policy requires contributors to offer a patent promise not to assert certain patent claims against other contributors and against implementers. The OpenID Foundation invites any interested party to bring to its attention any copyrights, patents, patent applications, or other proprietary rights that may cover technology that may be required to practice this specification. + +# Document History + +[[ To be removed from the final specification ]] + +-01 + + * align document structure with other FAPI drafts + * cite the published FAPI 2.0 specifications and RFC 9562 + * only echo `x-fapi-interaction-id` values that are UUIDs + * add advice on organization-level certificates, JARM downgrade, PKCE downgrade, native applications, confirming the same end-user, errors shown to the end-user and consent screens